Tracking multiple generations of a key to support decryption of historical data and controlled migration to current versions.